Security audit

定时助手

Security checks across malware telemetry and agentic risk

Overview

This scheduling skill is mostly about cron task management, but its broad unrelated activation text and persistent task mutation commands need review before installation.

Install only if you want an agent to manage scheduled jobs for explicit cron/reminder/workflow requests. Review generated commands before execution, require confirmation for deletes and bulk actions, and avoid relying on this skill for translation, generic file processing, or unrelated API work despite the broad claims in the text.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill metadata claims the skill should be used for translation/localization, while the body implements cron scheduling and command execution. This mismatch can cause the agent to activate the skill in unrelated contexts and then execute scheduling or shell-capable workflows the user did not intend, increasing the risk of inappropriate command execution or task creation.

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The capability coverage section lists translation/localization and other unrelated keywords as supported scenarios, contradicting the cron-assistant purpose. Broad, unrelated triggers can cause accidental invocation during normal conversation, routing non-scheduling requests into a skill with exec/write capabilities.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The feature list advertises general file handling, API integration, and information retrieval beyond the stated cron-assistant scope. Overstating capabilities can broaden activation and user trust, encouraging the agent or operator to use a shell-capable skill for tasks outside its intended safety model.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description uses overly broad activation language unrelated to cron, which can make the skill eligible for ambiguous, non-scheduling prompts. In the context of a skill with read/write/exec tools, unnecessary activation increases the chance of unintended side effects such as creating, modifying, or running tasks when the user sought something else.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The keyword-style coverage includes vague terms that overlap with ordinary conversation, making accidental dispatch more likely. Because the skill can execute commands and manage scheduled jobs, broad matching raises the risk of invoking operational actions from loosely related prompts.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents direct deletion of tasks without warning, dry-run, or confirmation guidance. In a scheduling assistant, deletion can permanently remove recurring jobs or one-time reminders, causing operational disruption or data-loss-like outcomes if triggered accidentally or via ambiguous task names.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.